1.6.2 Cybercrime and the Computer Misuse Act — Cambridge 9618

⚡

Pro Lesson

This lesson is part of the Cambridge 9618 Pro track. Upgrade to access all 82 lessons, worksheets, quizzes and mini tests.

Upgrade to Pro →

What is Cybercrime?

Cybercrime is any criminal activity that involves a computer or network — either as the tool used to commit the crime or as the target of the crime. It can be committed by individuals, organised criminal groups, or even nation-states.

The Computer Misuse Act 1990 (CMA)

The CMA is the primary UK legislation governing cybercrime. It defines three main offences (Sections 1, 2 and 3), with a further offence added by the Police and Justice Act 2006 (Section 3A):

Section 1

Unauthorised Access to Computer Material

Intentionally accessing a computer system without permission — even if no data is taken or damaged. This includes:

Logging into someone else's account
Accessing files you are not permitted to see at work
Any form of hacking or cracking into a system

Key point: The access must be intentional — accidentally seeing another user's screen does not satisfy this offence.

Section 2

Unauthorised Access with Intent to Commit Further Offences

Section 1 plus the intent to commit a further offence (e.g., blackmail, fraud, theft). The further offence does not need to have been committed — intent is sufficient.

Hacking a bank's system with intent to transfer funds
Accessing a person's email account to gather blackmail material

Section 3

Unauthorised Modification of Computer Material

Deliberately altering, damaging, or erasing data or programs without permission. Includes:

Installing malware, ransomware, or viruses
Deleting or encrypting another person's files
Altering a database record without authority
Distributed Denial of Service (DDoS) attacks

Section 3A (2006)

Making, Supplying or Obtaining Hacking Tools

Added by the Police and Justice Act 2006. Makes it illegal to create or distribute tools designed for use in cyberattacks — even if no attack has occurred. Includes:

Writing and distributing malware
Selling exploit kits or keyloggers
Providing tools specifically intended for DoS attacks

Types of Cyberattack

🦠 Malware

Malicious software designed to damage, disrupt, or gain unauthorised access. Includes viruses, worms, Trojans, spyware, adware.

CMA Section 3

🔒 Ransomware

Malware that encrypts the victim's files and demands payment for the decryption key. Often targets hospitals, businesses, and individuals.

CMA Section 3

🎣 Phishing

Fraudulent emails or messages that trick users into revealing passwords, credit card numbers, or other sensitive information by impersonating trusted organisations.

Section 1 + fraud laws

💥 DDoS Attack

Distributed Denial of Service — flooding a server with traffic from many computers (botnet) until it becomes unavailable to legitimate users.

CMA Section 3

🕵️ Social Engineering

Manipulating people into revealing confidential information or granting access — e.g., impersonating IT support to obtain a password.

Fraud + Section 1

🔑 Brute Force Attack

Systematically trying every possible password or key until the correct one is found. Can be performed offline against captured password hashes.

CMA Section 1

Protecting Against Cybercrime

Technical measures:

Strong, unique passwords + multi-factor authentication (MFA)
Firewalls — filter incoming/outgoing network traffic
Antivirus / anti-malware software
Intrusion Detection Systems (IDS)
Encryption — protects data in transit and at rest
Regular software updates and patching

Human/procedural measures:

Staff training and awareness (phishing recognition)
Access control — principle of least privilege
Regular data backups (3-2-1 rule: 3 copies, 2 media types, 1 offsite)
Security audits and penetration testing

CMA Offences — Summary Table

Section	Offence	Example	Max Sentence
S.1	Unauthorised access	Logging into someone's email	2 years
S.2	Unauthorised access with intent	Hacking to commit fraud	5 years
S.3	Unauthorised modification	Installing ransomware	10 years
S.3A	Making/supplying attack tools	Selling malware kits	10 years

Exam tip: When asked which section of the CMA applies, think: was there unauthorised ACCESS only (S.1)? Was there access plus intent to commit another crime (S.2)? Was there actual MODIFICATION of data/programs (S.3, includes installing malware, DDoS, ransomware)? Was someone making or supplying hacking tools (S.3A)? Always name the section and explain why.

⚠️ Common Mistakes

Saying ransomware is only "Section 1" — ransomware ENCRYPTS files (modification), so it is Section 3
Saying phishing is covered only by the CMA — phishing typically also involves fraud offences under the Fraud Act 2006
Saying DDoS attacks are only Section 1 — DDoS impairs computer performance, so it falls under Section 3 (unauthorised modification/impairment)
Forgetting Section 3A (2006 amendment) — making and supplying hacking tools is itself a crime

✅ Notes completed!

▶

Video coming soon

Click slide or press arrow keys to navigate

Worksheet — 1.6.2 Cybercrime & Computer Misuse Act

6 questions · instantly marked · Cambridge 9618 standard

Q1State the three main sections of the Computer Misuse Act 1990 and give one example of each.[6]

✅ Mark scheme

Section 1: Unauthorised access to computer material [1] e.g., logging into someone else's account [1]; Section 2: Unauthorised access with intent to commit further offences [1] e.g., hacking with intent to commit fraud [1]; Section 3: Unauthorised modification of computer material [1] e.g., installing ransomware / deleting files [1].

Q2A hacker encrypts all files on a hospital's server and demands £50,000 for the decryption key. Which section of the Computer Misuse Act applies and why?[3]

✅ Mark scheme

Section 3 — unauthorised modification of computer material [1]; encrypting files constitutes modifying/impairing the data on the computer [1]; this was done without the hospital's authorisation [1].

Q3Explain the difference between a phishing attack and a brute force attack.[4]

✅ Mark scheme

Phishing uses deception — fraudulent emails or websites trick the user into voluntarily revealing passwords or personal data by impersonating a trusted source [1+1]; brute force uses computation — the attacker systematically tries all possible passwords/keys until the correct one is found [1+1]; phishing exploits human psychology; brute force exploits weak or short passwords.

Q4A criminal sells a software kit specifically designed to launch DDoS attacks. Which section of the Computer Misuse Act applies?[2]

✅ Mark scheme

Section 3A (added by Police and Justice Act 2006) [1]; this section makes it illegal to make, supply or obtain tools specifically designed for use in cyberattacks / computer misuse [1].

Q5Describe three technical measures an organisation can use to protect against cyberattacks.[3]

✅ Mark scheme

Any three: firewall — filters incoming/outgoing network traffic to block unauthorised access [1]; antivirus/anti-malware — detects and removes malicious software [1]; multi-factor authentication — requires additional verification beyond password, harder to breach [1]; encryption — data is unreadable without the key even if intercepted [1]; regular patching/updates — fixes known security vulnerabilities [1].

Q6Explain what a DDoS attack is and why it is covered under Section 3 of the Computer Misuse Act rather than Section 1.[4]

✅ Mark scheme

DDoS (Distributed Denial of Service): the attacker uses many computers (botnet) to flood a server with traffic, overwhelming it so legitimate users cannot access the service [1+1]; Section 1 covers unauthorised access — in DDoS there may be no direct access to the system's data [1]; Section 3 covers unauthorised modification/impairment — flooding a server impairs its ability to function, which counts as impairing computer performance without authorisation [1].

Q7Describe three distinct offences created by the Computer Misuse Act 1990. For each offence, give one example of an act that would constitute that offence and state whether the offence carries a higher or lower maximum penalty than the others.[6]

✅ Mark scheme

Offence 1 (Section 1): unauthorised access to computer material — e.g. guessing someone's password and logging in to read their email — lower penalty (up to 2 years) — 1 mark + example; Offence 2 (Section 2): unauthorised access with intent to commit a further offence — e.g. hacking a bank to steal funds — higher penalty (up to 5 years) — 1 mark + example; Offence 3 (Section 3): unauthorised modification of computer material — e.g. deploying ransomware to encrypt files — highest penalty (up to 10 years) — 1 mark + example. (Award 2 per offence: 1 description + 1 example/penalty.)

Q8Explain how a brute-force attack works to gain unauthorised access to a system. Describe two defences a system administrator can implement to significantly reduce the risk of a successful brute-force attack.[5]

✅ Mark scheme

Brute-force: automatically trying every possible combination of characters for a password until the correct one is found — 1 mark; can use dictionary of common passwords or systematic character-by-character enumeration — 1 mark; Defence 1: account lockout after a small number of failed attempts (e.g. 5), preventing rapid enumeration — 1 mark; Defence 2: enforcing minimum password length and complexity (e.g. 12+ characters, mixed case, numbers, symbols), making the search space too large to enumerate in a practical time — 1 mark; additional: multi-factor authentication makes a correct password insufficient on its own — 1 mark.

Topic Quiz

Question 1 of 10

You scored

out of 10

Card 1 of 8

Click to reveal definition

🎉

All cards reviewed!

Term	Definition

What is Cybercrime?

The Computer Misuse Act 1990 (CMA)

Unauthorised Access to Computer Material

Unauthorised Access with Intent to Commit Further Offences

Unauthorised Modification of Computer Material

Making, Supplying or Obtaining Hacking Tools

Types of Cyberattack

Protecting Against Cybercrime

CMA Offences — Summary Table

Worksheet — 1.6.2 Cybercrime & Computer Misuse Act

Mini Test — 1.6.2 Cybercrime & CMA